Missing Authentication check in message server info service, SAP security note 2331908

SAP security note 2331908, “Missing Authentication Check in Message Server Info Service.” Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Message server info service does not perform any authentication checks for functionalities that require user identity.

Some well-known impacts of Missing Authentication check are:

• Read, modify, or delete sensitive information
• Access administrative or other privileged functionalities

Solution

The affected functions of the message server info service have been enforced to properly check access restrictions.

Implement the Support Packages and Patches referenced by this SAP Note.

CVSS

Score 7.3/10 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected components

• Basis Components > NetWeaver Application Server Java > Local Admin Tools > Monitoring